Webhooks transmit information directly from the Custody Infrastructure platform to your listener machine. If you are transmitting sensitive information, you will want to ensure the security of your data in-flight from your custody platform to your listener.

Galaxy's Custody Infrastructure cannot take responsibility for how data is stored on your listening machine or the security of your packets in motion from the Custody Infrastructure platform to the listener. This article contains common-sense steps to help provide more secure handling of your webhook return data in motion.

Configuring your listener machine with an HTTPS address and directing all webhook traffic there ensures your data in motion uses the following security measures:

Even using HTTPS, a malicious actor can target your listener's address with fake traffic in a denial-of-service attack. To do so, the actor must know your listener's URL. Appending a randomly generated value to your listener's address and the webhook URL makes the listener's address much more challenging to attack.

This string is generated once and then used in both setting up the webhook and the listener machine.

For example:

https://<listener_url>/random_secret_token=sadkfnherwklfnvkwlrhnjfklewjflkewjnknwklonewklfnewkonlkewnkwe

Your listener needs to authenticate the random key. Once authenticated, you will probably want to route the webhook according to your business logic.

Learn about configuring webhooks in the Webhook Usage article. For a more technical overview, check out the /registerWebhook API endpoint.

See what data webhook output can contain (and why it's so essential to secure it!) in Webhook v2 Output .

You can review your current webhook configuration using the /getAllWebhooks endpoint.